feat(lighthouse): add weekly lighthouse audit scan

[tehw0lf]

Summary

• Adds weekly Lighthouse audit running every Monday at 04:00 UTC (after DAST at 03:00)
• Uses reusable workflow from tehw0lf/workflows — requires workflows PR Revert "Fix master pipeline" #89 to be merged first
• Reports Performance, Accessibility, Best Practices and SEO scores as Step Summary
• Informational only, does not block merges

Test plan

• Merge feat(lighthouse): add reusable lighthouse audit workflow workflows#89 first
• Merge this PR
• Trigger manually via workflow_dispatch to verify scores appear in Step Summary

Summary by CodeRabbit

• New Features
  • Added a weekly automated Lighthouse scan for the public site.
  • The scan can also be started manually when needed.
  • Improved monitoring by sending scan results through the platform’s issue-tracking flow.

[coderabbitai]

Warning

Review limit reached

@tehw0lf, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 27 minutes. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b70377f4-b3a7-4754-a027-5df80ece9303

📥 Commits

Reviewing files that changed from the base of the PR and between ec5726f and 3f92634.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow that runs weekly or manually and invokes a reusable lighthouse scan workflow against https://tehwolf.de with read-only contents access and issue write permission.

Changes

Weekly Lighthouse scan workflow

Layer / File(s)	Summary
Workflow trigger and job wiring .github/workflows/lighthouse-scan.yml	Defines the weekly lighthouse scan workflow with a weekly cron trigger, workflow_dispatch, a lighthouse job that reuses an external workflow, and target_url plus permissions settings.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• tehw0lf/tehwol.fi#269: Adds a closely related scheduled GitHub Actions scan workflow using the same reusable lighthouse pattern and target URL.

Poem

I hopped by moonlight, ears held high,
To scan the site beneath the sky.
Weekly bells and manual pings,
Bring lighthouse checks and glowing wings.
🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a weekly Lighthouse audit scan workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/lighthouse-scan

---

_{Comment @coderabbitai help to get the list of available commands.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 751ae0c

Command	Status	Duration	Result
nx affected:build	✅ Succeeded	1s	View ↗
nx e2e tehwolfde-e2e	✅ Succeeded	<1s	View ↗
nx affected:test -- --ci --coverage --watchAll=...	✅ Succeeded	<1s	View ↗
nx affected:lint	✅ Succeeded	13s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-06-24 20:48:29 UTC

[nx-cloud]

View your CI Pipeline Execution ↗ for commit ec5726f

Command	Status	Duration	Result
nx affected:build	✅ Succeeded	<1s	View ↗
nx e2e tehwolfde-e2e	✅ Succeeded	<1s	View ↗
nx affected:test -- --ci --coverage --watchAll=...	✅ Succeeded	<1s	View ↗
nx affected:lint	✅ Succeeded	<1s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-06-24 18:58:08 UTC

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/lighthouse-scan.yml:
- Line 11: The reusable workflow reference in the lighthouse scan job is pinned
to a mutable branch, so update the uses reference to a fixed, reviewable ref
such as a tag or commit SHA. Locate the workflow call in the lighthouse scan job
and replace the current `@main` target with an immutable version so the dependency
cannot change unexpectedly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 48102aa9-b535-4241-9d30-b1d2ae89421b

📥 Commits

Reviewing files that changed from the base of the PR and between 6a5c0ad and ec5726f.

📒 Files selected for processing (1)

• .github/workflows/lighthouse-scan.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== file listing ==\n'
git ls-files .github/workflows/lighthouse-scan.yml

printf '\n== workflow file with line numbers ==\n'
cat -n .github/workflows/lighthouse-scan.yml

printf '\n== any local references to the external workflow repo/ref ==\n'
rg -n "tehw0lf/workflows|lighthouse-scan.yml@|workflow_call" .github/workflows . -g '!**/node_modules/**' || true

Repository: tehw0lf/tehwol.fi

Length of output: 1312

---

Pin the reusable workflow ref.

uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@main tracks a mutable branch, so this external dependency can change without review and weakens reproducibility.

🔧 Suggested fix

-    uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@main
+    uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@<commit-sha>

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@main
	uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@<commit-sha>

🧰 Tools

🪛 zizmor (1.26.1)

[error] 11-11: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lighthouse-scan.yml at line 11, The reusable workflow
reference in the lighthouse scan job is pinned to a mutable branch, so update
the uses reference to a fixed, reviewable ref such as a tag or commit SHA.
Locate the workflow call in the lighthouse scan job and replace the current
`@main` target with an immutable version so the dependency cannot change
unexpectedly.

Source: Linters/SAST tools

[tehw0lf]

This works as designed